PS-02—Threat Hunting

>Control Description

Organization performs threat hunting to identify, track, and disrupt threats that evade existing security controls.

Theme

Process

Type

Preventive

Policy/Standard

Incident Management Policy

>Implementation Guidance

1. Conduct cyber threat hunting activities according to an organization-defined frequency and/or organization-defined event to detect, track, and disrupt threats that evade existing controls. 2. Establish a threat hunting methodology in accordance with the organization's security objectives. 3. Define threat indicator information and effective mitigations.

>Testing Procedure

1. Inspect whether cyber threat hunting activities are performed as per defined frequency to detect, track, and disrupt threats that evade existing controls. 2. Validate whether a threat hunting methodology exists in accordance with the organization's security objectives. 3. Inspect the threat indicator information and effective mitigations.

>Audit Artifacts

E-PS-02

E-PS-03

>Framework Mappings

Cross-framework mappings provided by Adobe CCF Open Source under Creative Commons License.

ISO 27002:2022
1

5.7

Ask AI

Configure your API key to use AI features.